CVE-2026-3367: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in lustmored Lockme calendars integration

CVE-2026-3367 is a stored cross-site scripting vulnerability in the Lockme OAuth2 calendars integration WordPress plugin affecting all versions up to 2.11.0. The vulnerability is due to missing sanitization callbacks in the register_setting() function, allowing unsanitized data to be stored via update_option(). When rendering the settings page, the stored values are output directly into HTML input value attributes without proper escaping (esc_attr()), enabling authenticated administrators to inject arbitrary JavaScript. Multiple fields are affected, including App ID, App Secret, Bookings ID prefix, and API domain. This flaw can lead to script execution in the context of the plugin settings page, with increased impact in multisite setups.

An authenticated attacker with administrator-level access can inject and execute arbitrary JavaScript in the plugin's settings page. This can lead to cross-site scripting attacks affecting administrators and potentially other users accessing the settings page. The vulnerability compromises confidentiality and integrity (low impact) but does not affect availability. In multisite WordPress installations, the risk is elevated as site administrators could execute scripts impacting other sites' users, breaching site isolation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and avoid visiting the plugin settings page in untrusted environments. Monitor vendor channels for updates or patches addressing this vulnerability. Do not rely on generic mitigations; this vulnerability requires proper input sanitization and output escaping in the plugin code.